Strong Customer Authentication in Online Payments Under GDPR and PSD2: A Case of Cumulative Application - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2021

Strong Customer Authentication in Online Payments Under GDPR and PSD2: A Case of Cumulative Application

Résumé

Authentication is the process of confirming the user’s identity before the payment can be performed. It contributes to cybersecurity by preventing access by unauthorised parties. However, in e-payments the authentication differs from traditional identity checks since it is performed online and remotely. This paper explores the relationship between two important legal instruments on authentication in payment services: General data protection regulation (Regulation 679/2016) and the Second payment services directive (Directive 2015/2366). This paper shows that while the relationship between the two instruments can be considered unclear, previous research and European soft law favour cumulative application, and not a lex specialis and lex generalis relationship. These findings are then discussed in the context of implementing authentication procedures in compliance with the rules of the GDPR, with a focus on the identity of the controller, legal basis for implementing authentication, and the security requirements under art. 32 of the GDPR. Based on the “means reasonably likely" test from the Breyer judgment, we assume that PSPs could be considered controllers even when processing pseudonymised credentials. Legal grounds to process personal data in an authentication procedure are either performance of a contract or legitimate interests of the controller, insofar as the necessity criterion is met. Relying on legal obligation is, however, more doubtful. Finally, exceptions to strong customer authentication bring their own cybersecurity considerations, since complexity of security systems can lead to more vulnerabilities. When PSD2 and GDPR are both applied, it may mean that compliance with the higher standard is required, which is enabled by the optional nature of art. 18(1) of the RTS.
Fichier principal
Vignette du fichier
498598_1_En_5_Chapter.pdf (176.36 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03703763 , version 1 (24-06-2022)

Licence

Paternité

Identifiants

Citer

Danaja Fabcic. Strong Customer Authentication in Online Payments Under GDPR and PSD2: A Case of Cumulative Application. 15th IFIP International Summer School on Privacy and Identity Management (Privacy and Identity), Sep 2020, Maribor, Slovenia. pp.78-95, ⟨10.1007/978-3-030-72465-8_5⟩. ⟨hal-03703763⟩
35 Consultations
18 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More